Analysis

  • max time kernel
    91s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/03/2023, 06:42

General

  • Target

    4c6587ccf02e86315a81ae5c1abbdb447993f381ee8e54a736761cd0a996e3c9.exe

  • Size

    312KB

  • MD5

    ce72b20d96d366402975c49b27094123

  • SHA1

    02c65585edaae3ebc8528eb4ff83d5a2e5fd9783

  • SHA256

    4c6587ccf02e86315a81ae5c1abbdb447993f381ee8e54a736761cd0a996e3c9

  • SHA512

    7b9a4d3ba1059623682483fe7676e40ceffec9315fed78598060ae33c7cd6c591c2d3320dd2ae672b913f434c45cdb01195199478b8299edcd222cf6a704da79

  • SSDEEP

    3072:e4wBlxFRGw58XqudMxI+Otg4UswfChY4GSSzZWlXY5R1pkPpaeuxvrm2H75brsAP:klxeLquFtKwQ1We6aBVJ75vh7dik

Malware Config

Signatures

  • Detect rhadamanthys stealer shellcode 4 IoCs
  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

  • Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4c6587ccf02e86315a81ae5c1abbdb447993f381ee8e54a736761cd0a996e3c9.exe
    "C:\Users\Admin\AppData\Local\Temp\4c6587ccf02e86315a81ae5c1abbdb447993f381ee8e54a736761cd0a996e3c9.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4696
    • C:\Windows\system32\dllhost.exe
      "C:\Windows\system32\dllhost.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • outlook_office_path
      • outlook_win_path
      PID:864
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4696 -s 708
      2⤵
      • Program crash
      PID:1056
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4696 -ip 4696
    1⤵
      PID:4344

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/864-149-0x00007FF4A9D50000-0x00007FF4A9E4A000-memory.dmp

      Filesize

      1000KB

    • memory/864-147-0x00007FF4A9D50000-0x00007FF4A9E4A000-memory.dmp

      Filesize

      1000KB

    • memory/864-154-0x00007FF4A9D50000-0x00007FF4A9E4A000-memory.dmp

      Filesize

      1000KB

    • memory/864-153-0x00007FF4A9D50000-0x00007FF4A9E4A000-memory.dmp

      Filesize

      1000KB

    • memory/864-152-0x00007FF4A9D50000-0x00007FF4A9E4A000-memory.dmp

      Filesize

      1000KB

    • memory/864-146-0x0000016DA32F0000-0x0000016DA32F7000-memory.dmp

      Filesize

      28KB

    • memory/864-148-0x00007FF4A9D50000-0x00007FF4A9E4A000-memory.dmp

      Filesize

      1000KB

    • memory/864-144-0x0000016DA32A0000-0x0000016DA32A1000-memory.dmp

      Filesize

      4KB

    • memory/4696-142-0x00000000024A0000-0x00000000034A0000-memory.dmp

      Filesize

      16.0MB

    • memory/4696-135-0x0000000000400000-0x00000000004BE000-memory.dmp

      Filesize

      760KB

    • memory/4696-145-0x0000000002280000-0x0000000002282000-memory.dmp

      Filesize

      8KB

    • memory/4696-143-0x0000000000790000-0x00000000007AC000-memory.dmp

      Filesize

      112KB

    • memory/4696-134-0x0000000000750000-0x000000000077E000-memory.dmp

      Filesize

      184KB

    • memory/4696-150-0x0000000000400000-0x00000000004BE000-memory.dmp

      Filesize

      760KB

    • memory/4696-151-0x0000000000790000-0x00000000007AC000-memory.dmp

      Filesize

      112KB

    • memory/4696-141-0x00000000007B0000-0x00000000007CA000-memory.dmp

      Filesize

      104KB

    • memory/4696-140-0x0000000000790000-0x00000000007AC000-memory.dmp

      Filesize

      112KB

    • memory/4696-138-0x0000000000790000-0x00000000007AC000-memory.dmp

      Filesize

      112KB